Threat Modeling From The Trenches To The Clouds SESSION ID: Brook S.E. Schoenfield Threat Modeling...

33
#RSAC SESSION ID: SESSION ID: #RSAC Brook S.E. Schoenfield Threat Modeling From The Trenches To The Clouds AIR-W02 Passionate security architect Curious questioner Principal Engineer, Intel Security

Transcript of Threat Modeling From The Trenches To The Clouds SESSION ID: Brook S.E. Schoenfield Threat Modeling...

Page 1: Threat Modeling From The Trenches To The Clouds SESSION ID: Brook S.E. Schoenfield Threat Modeling From The Trenches To The Clouds AIR-W02 Passionate security architect Curious questioner

#RSAC

SESSION ID:SESSION ID:

#RSAC

Brook S.E. Schoenfield

Threat Modeling From The Trenches To The Clouds

AIR-W02

Passionate security architectCurious questionerPrincipal Engineer, Intel Security

Page 2: Threat Modeling From The Trenches To The Clouds SESSION ID: Brook S.E. Schoenfield Threat Modeling From The Trenches To The Clouds AIR-W02 Passionate security architect Curious questioner

#RSAC

“TM” == Threat Modeling!

Page 3: Threat Modeling From The Trenches To The Clouds SESSION ID: Brook S.E. Schoenfield Threat Modeling From The Trenches To The Clouds AIR-W02 Passionate security architect Curious questioner

#RSAC

Page 4: Threat Modeling From The Trenches To The Clouds SESSION ID: Brook S.E. Schoenfield Threat Modeling From The Trenches To The Clouds AIR-W02 Passionate security architect Curious questioner

#RSAC

Based Upon What?

Trained 100’s of security architects over 15+ years

51 Intel Security TM training sessionsTM every type of architecture— Below OS to global clouds

300+ people trained throughout Intel + 3 teachers

Page 5: Threat Modeling From The Trenches To The Clouds SESSION ID: Brook S.E. Schoenfield Threat Modeling From The Trenches To The Clouds AIR-W02 Passionate security architect Curious questioner

#RSAC

From What Exprience Is This Drawn?

Trained 100’s of security architects over 15 years

51 Intel Security TM training sessionsTM every type of architecture— Below OS to global clouds

300+ people trained throughout Intel +3 teachers

Page 6: Threat Modeling From The Trenches To The Clouds SESSION ID: Brook S.E. Schoenfield Threat Modeling From The Trenches To The Clouds AIR-W02 Passionate security architect Curious questioner

#RSAC

Threat modeling is a technique to identify the attacks a system1 must resist and the defenses that will bring the system to a desired defensive state

1. “system” is defined inclusively

Working Definition

Page 7: Threat Modeling From The Trenches To The Clouds SESSION ID: Brook S.E. Schoenfield Threat Modeling From The Trenches To The Clouds AIR-W02 Passionate security architect Curious questioner

#RSAC

Our Collective Challenge == Secure Design

Little progress in 20+ years!Early standard = NIST 800-14, 1996!

Is it simply that “developers don’t care”?Or, “developers are dumb”? Or, “Developers have no training”

Page 8: Threat Modeling From The Trenches To The Clouds SESSION ID: Brook S.E. Schoenfield Threat Modeling From The Trenches To The Clouds AIR-W02 Passionate security architect Curious questioner

#RSAC

Consider Recent Design Misses

That Jeep Wrangler

Open WiFi Pacemaker

The Target breach was a system design failure

Page 9: Threat Modeling From The Trenches To The Clouds SESSION ID: Brook S.E. Schoenfield Threat Modeling From The Trenches To The Clouds AIR-W02 Passionate security architect Curious questioner

#RSAC

Old Guard

Central team• Consultants

/employees

Parachute into project

Find as many “flaws1” as

possible

Generate requirements •unprioritized

On to next TM Pre-release governance

1. Gary McGraw’s term

Page 10: Threat Modeling From The Trenches To The Clouds SESSION ID: Brook S.E. Schoenfield Threat Modeling From The Trenches To The Clouds AIR-W02 Passionate security architect Curious questioner

#RSAC

Old Guard

Central team• Consultants

/employees

Parachute into project

Find as many “flaws1” as

possible

Generate requirements •unprioritized

On to next TM Pre-release governance

1. Gary McGraw’s term

Page 11: Threat Modeling From The Trenches To The Clouds SESSION ID: Brook S.E. Schoenfield Threat Modeling From The Trenches To The Clouds AIR-W02 Passionate security architect Curious questioner

#RSAC

Are These Your Challenges?

Only staff critical apps

Fight between “creativity” & “security”

Security requirements don’t can’t be built

Business always trumps security

Threat model treated as irrelevant or bureaucratic

Security are synonymous with ”No”

Page 12: Threat Modeling From The Trenches To The Clouds SESSION ID: Brook S.E. Schoenfield Threat Modeling From The Trenches To The Clouds AIR-W02 Passionate security architect Curious questioner

#RSAC

Be Different!

Decentralize

Fully empower

Skill can be built, difficult to buy1-2 highly skilled hires who both execute and teach

Play a long game, sometimes a very long game

Teach, coach, mentor, let go

Page 13: Threat Modeling From The Trenches To The Clouds SESSION ID: Brook S.E. Schoenfield Threat Modeling From The Trenches To The Clouds AIR-W02 Passionate security architect Curious questioner

#RSAC

Be Different!

Decentralize

Fully empower

Skill can be built, difficult to buy1-2 highly skilled hires who both execute and teach

Play a long game, sometimes a very long game

Teach, coach, mentor, let go

Wash

Rinse

Repeat

Page 14: Threat Modeling From The Trenches To The Clouds SESSION ID: Brook S.E. Schoenfield Threat Modeling From The Trenches To The Clouds AIR-W02 Passionate security architect Curious questioner

#RSAC

Grassroots

TM is part of the ”woodwork”, the “expected” flow

Go viral: build generations of teachers

Leverage each level of skill

Page 15: Threat Modeling From The Trenches To The Clouds SESSION ID: Brook S.E. Schoenfield Threat Modeling From The Trenches To The Clouds AIR-W02 Passionate security architect Curious questioner

#RSAC

Involve Everyone

Team sportEveryone! Really!

It takes a village to build a complete threat model

Prioritization is hard. All the stakeholders must be involved

It’s fun! (yeah, it really is)

• Product managers• Quality people• Devops• SDETs• Developers

• Designers• Architects• Security experts• Facilitator• Project management

Page 16: Threat Modeling From The Trenches To The Clouds SESSION ID: Brook S.E. Schoenfield Threat Modeling From The Trenches To The Clouds AIR-W02 Passionate security architect Curious questioner

#RSAC

A threat model is a crossroads of knowledge from architecture experts, domain experts, and security expertsAbsence of one or more stakeholders cripples the model and its usefulness

Page 17: Threat Modeling From The Trenches To The Clouds SESSION ID: Brook S.E. Schoenfield Threat Modeling From The Trenches To The Clouds AIR-W02 Passionate security architect Curious questioner

#RSAC

Iteration Is Your Friend

Let the threat model breathe

Security implementation can improve through iteration

Changes of structure trigger review of model

Changes to security trigger re-evaluation Especially of the design

Page 18: Threat Modeling From The Trenches To The Clouds SESSION ID: Brook S.E. Schoenfield Threat Modeling From The Trenches To The Clouds AIR-W02 Passionate security architect Curious questioner

#RSAC

Prioritizing

Risk is the way! Calculating risk is difficult

Adopt an easy risk analysis methodologyJust Good Enough Risk Rating (JGERR)1 or similar

Work towards the intended postureParticular systemRelevant threat agentsImpactful assetsUser expectationsSystem OwnersOrganization’s risk tolerance

1. co-author, Vinay Bansal, 2008, based upon Factor Analysis of Information Risk, Jack Jones, Open Group Standard

Page 19: Threat Modeling From The Trenches To The Clouds SESSION ID: Brook S.E. Schoenfield Threat Modeling From The Trenches To The Clouds AIR-W02 Passionate security architect Curious questioner

#RSAC

Prioritizing

Risk is the way! But that’s hard

Adopt an easy risk analysis methodologyJust Good Enough Risk Rating1 or similar

Must understand the intended postureParticular systemUser expectationsSystem OwnersOrganization’s risk tolerance

1. co-author, Vinay Bansal, 2008, based upon Factor Analysis of Information Risk, Jack Jones, Open Group Standard

Page 20: Threat Modeling From The Trenches To The Clouds SESSION ID: Brook S.E. Schoenfield Threat Modeling From The Trenches To The Clouds AIR-W02 Passionate security architect Curious questioner

#RSAC

Get Out And See The Architectural World

Analyze unfamiliar architectures and unfamiliar structural types

Build skill; attend analysis with othersAcross organizational boundariesAcross projects

Page 21: Threat Modeling From The Trenches To The Clouds SESSION ID: Brook S.E. Schoenfield Threat Modeling From The Trenches To The Clouds AIR-W02 Passionate security architect Curious questioner

#RSAC“Keystone” activityParticipation results:

Why security is crucial

What to worry about and what not Sense of the risk posture for their systemPriorities

How each role contributes

SDL tasks, Security Definition of Done

Page 22: Threat Modeling From The Trenches To The Clouds SESSION ID: Brook S.E. Schoenfield Threat Modeling From The Trenches To The Clouds AIR-W02 Passionate security architect Curious questioner

#RSAC

Governance

Central boards are a bottleneck

The best don’t have to “approve” everything

Page 23: Threat Modeling From The Trenches To The Clouds SESSION ID: Brook S.E. Schoenfield Threat Modeling From The Trenches To The Clouds AIR-W02 Passionate security architect Curious questioner

#RSAC

Peer Review Governance

Central boards are a bottleneck

The best don’t have to “approve” every model

Page 24: Threat Modeling From The Trenches To The Clouds SESSION ID: Brook S.E. Schoenfield Threat Modeling From The Trenches To The Clouds AIR-W02 Passionate security architect Curious questioner

#RSAC

Learn By Doing

Experience -> Reflection -> Integration1

Let participants find personal learning

Active participation

Solve problems

Keep didactic to a minimum

Problems highlight concepts

Exercises increase in difficulty and scope

Every analysis holds validity (even if off-base)

1. Empowered learning model – Eric Bear, Mary Klein, et al,based on Pedagogy of the Oppressed – Paulo Freire, 1968

Page 25: Threat Modeling From The Trenches To The Clouds SESSION ID: Brook S.E. Schoenfield Threat Modeling From The Trenches To The Clouds AIR-W02 Passionate security architect Curious questioner

#RSAC

The Downside

Trees for the forest analyses

Accepting component threat models w/o analysis

Lose the centre

Poor visibility of errors

Page 26: Threat Modeling From The Trenches To The Clouds SESSION ID: Brook S.E. Schoenfield Threat Modeling From The Trenches To The Clouds AIR-W02 Passionate security architect Curious questioner

#RSAC

Take Aways

Build, because we couldn’t buy/hireGrassroots + management + executivesTrain & mentor as though our lives depend upon it

Don’t sweat the small stuff!Exceptions are my friends

Involve everyone

Iterate to stay in sync and for improvement

Peer review => governance

Threat modeling is The Keystone activity

Continual care and feeding

Page 27: Threat Modeling From The Trenches To The Clouds SESSION ID: Brook S.E. Schoenfield Threat Modeling From The Trenches To The Clouds AIR-W02 Passionate security architect Curious questioner

#RSAC

Shameless Self-promotion

https://www.facebook.com/securingsystems

https://www.facebook.com/securingsystems
Page 28: Threat Modeling From The Trenches To The Clouds SESSION ID: Brook S.E. Schoenfield Threat Modeling From The Trenches To The Clouds AIR-W02 Passionate security architect Curious questioner

#RSAC

A Threat Modeling Library

https://www.facebook.com/securingsystems

https://www.facebook.com/securingsystems
Page 29: Threat Modeling From The Trenches To The Clouds SESSION ID: Brook S.E. Schoenfield Threat Modeling From The Trenches To The Clouds AIR-W02 Passionate security architect Curious questioner

#RSAC

Developer-centric Security

Enable creativity and innovation

Secure innovation

Let’s start a movement!

Page 30: Threat Modeling From The Trenches To The Clouds SESSION ID: Brook S.E. Schoenfield Threat Modeling From The Trenches To The Clouds AIR-W02 Passionate security architect Curious questioner

#RSAC

Some Resources

https://www.owasp.org/index.php/Application_Threat_Modelinghttps://www.owasp.org/index.php/Threat_Risk_Modelinghttps://www.owasp.org/images/a/aa/AppSecEU2012_PASTA.pdfhttp://resources.sei.cmu.edu/library/asset-view.cfm?AssetID=427321http://www.intel.com/Assets/en_US/PDF/whitepaper/wp_IT_Security_RiskAssessment.pdfhttps://www.facebook.com/securingsystemshttp://www.amazon.com/Securing-Systems-Applied-Security-Architecture/dp/1482233975https://www.facebook.com/softwaresecwww.amazon.com/Core-Software-Security-Source

https://www.owasp.org/index.php/Application_Threat_Modeling
https://www.owasp.org/index.php/Threat_Risk_Modeling
https://www.owasp.org/images/a/aa/AppSecEU2012_PASTA.pdf
http://www.amazon.com/Securing-Systems-Applied-Security-Architecture/dp/1482233975
https://www.facebook.com/softwaresec
http://www.amazon.com/Core-Software-Security-Source
Page 31: Threat Modeling From The Trenches To The Clouds SESSION ID: Brook S.E. Schoenfield Threat Modeling From The Trenches To The Clouds AIR-W02 Passionate security architect Curious questioner

#RSAC

Where To Find Me

[email protected]

http://www.brookschoenfield.com

[email protected]

@BrkSchoenfield

1. I apologize in advance. I only Linkedin with people with whom I’ve had meaningful interaction. Thanks.

Page 32: Threat Modeling From The Trenches To The Clouds SESSION ID: Brook S.E. Schoenfield Threat Modeling From The Trenches To The Clouds AIR-W02 Passionate security architect Curious questioner

#RSAC

Brook’s Social Networking

https://www.linkedin.com/in/brookschoenfield 1

http://www.amazon.com/Brook-S.-E.-Schoenfield/e/B00XQFZLSW

1. I apologize in advance. I only Linkedin with people with whom I’ve had meaningful interaction. Thanks.

https://www.linkedin.com/in/brookschoenfield
http://www.amazon.com/Brook-S.-E.-Schoenfield/e/B00XQFZLSW
Page 33: Threat Modeling From The Trenches To The Clouds SESSION ID: Brook S.E. Schoenfield Threat Modeling From The Trenches To The Clouds AIR-W02 Passionate security architect Curious questioner

#RSAC

www.brookschoenfield.com


In The Trenches

In The Trenches

Artic - porcelanatoliquido.net · 4807126 -free-sky-wallpaper jpg clouds clouds texture6118jpg clouds clouds clouds clouds texture6110.jpg clouds texturE6115jpg clouds texture6120.jpg

Artic - porcelanatoliquido.net · 4807126 -free-sky-wallpaper jpg clouds clouds texture6118jpg clouds clouds clouds clouds texture6110.jpg clouds texturE6115jpg clouds texture6120.jpg

Symfony2 - from the trenches

Symfony2 - from the trenches

VTrenchv Trenches Rules 3

VTrenchv Trenches Rules 3

Training & Trenches FINAL

Training & Trenches FINAL

Clouds - Metlink...Cirrus made by an aeroplane (aircraft contrail cirrus) Clouds Cumulus 1 Clouds Cumulus 2 Clouds Cumulus 3 Clouds Nimbostratus Clouds Nimbostratus with rainbow Clouds

Clouds - Metlink...Cirrus made by an aeroplane (aircraft contrail cirrus) Clouds Cumulus 1 Clouds Cumulus 2 Clouds Cumulus 3 Clouds Nimbostratus Clouds Nimbostratus with rainbow Clouds

CLOUDS. What are clouds? .

CLOUDS. What are clouds? .

DDoS Threat to Clouds

DDoS Threat to Clouds

Trenches Project

Trenches Project

Trenches Group Activity

Trenches Group Activity

Christmas In The Trenches

Christmas In The Trenches

6G. Shear Trenches

6G. Shear Trenches

V FROM TRENCHES

V FROM TRENCHES

Clouds, Rain, Clouds Again

Clouds, Rain, Clouds Again

the Trenches - AZBOCUG

the Trenches - AZBOCUG

Automation from the trenches

Automation from the trenches

Clouds Cumulus CU Low clouds - cumuliform -. clouds Cumulus CU Low clouds - cumuliform -

Clouds Cumulus CU Low clouds - cumuliform -. clouds Cumulus CU Low clouds - cumuliform -

Life in the trenches

Life in the trenches

War in the Trenches

War in the Trenches

In the Trenches - compilation the Trenches - compilati… · Official Publication of the National Educator Program - Special Series - “In the Trenches” Interviews with the original

In the Trenches - compilation the Trenches - compilati… · Official Publication of the National Educator Program - Special Series - “In the Trenches” Interviews with the original